Read the docs
TI-2026-86078 Aliases CVE-2026-123996GHSA-8qh4-38v4-7w3v

Missing authentication in Hisense VIDAA Smart TV UPnP/DLNA service

Priority LOW 21CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 is affected. The UPnP/DLNA RenderingControl service on TCP port 38400 does not check authentication for each command after a one-time DLNA pairing (CWE-306). A LAN-adjacent attacker can send unauthenticated commands that change volume and mute, override the physical remote, and reset picture and audio calibration settings. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) commands after a one-time DLNA pairing with no per-command authentication or session token. Attackers can send a continuous loop of unauthenticated commands to override the physical remote, change volume and mute, and reset all picture and audio calibration settings.

Why it matters now

EPSS 0.00156 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HisenseVIDAA0000.01.00a.P0220—No fix listedCNA
  • VIDAA VendorHisense Affected 0000.01.00a.P0220 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Hisense VIDAA.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123996
  2. 2026-11-06 Alias added: GHSA-8qh4-38v4-7w3v

References

Exploit 1

  • TI-2026-86075 Unauthenticated WebDriver access in Hisense VIDAA Smart TV CVSS 4.0HIGH 8.7
  • TI-2026-86080 Authentication bypass in Hisense VIDAA Smart TV MQTT broker CVSS 4.0HIGH 7.2
  • TI-2026-86079 Denial of service in Hisense VIDAA Smart TV via UPnP AVTransport CVSS 4.0HIGH 7.1
  • TI-2019-11476 The Hisense F17 Android device with a build fingerprint of… CVSS 3.1MEDIUM 5.5
  • TI-2019-11464 The Hisense U965 Android device with a build fingerprint of… CVSS 3.1MEDIUM 5.5
  • TI-2026-86076 Hisense VIDAA Smart TV DIAL Service Unauthenticated Access CVSS 4.0MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences